So in the previous video, we talked about crawlers, but don't forget, search engines are the best
crawlers.
They work almost exactly as we want them to, and they have a huge amount of data about the publicly
exposed Web applications.
See, when a search engine bot crawls a Web application, it indexes the pages according to some rules
that are associated to the page and its content.
They can index almost anything within a Web site, including sensitive information.
So they have a complex working style and they always update the way they crawl.
But at the end of the day, they provide us with so much good information from.
Everything from error messages to vulnerable files and servers.
OK, so now go to Caleigh and open up your browser.
And for the majority of our generation, Google is one of the first search engines that comes to mind.
But it is by no means alone, there are several other search engines, such as Being and Yandex and
Yahoo!
And of course anybody could go on, but we are going to conduct the Google queries to get more.
So for the average person, Google is just a search engine used to find text, images, videos, it's
even a spellchecker for some.
However, for Penn testers, Google is a very useful hacking tool.
So go ahead, type Google dot com.
And you can run Google search queries from this interface.
But besides his simple interface, Google has an advanced search functionality.
So go to settings and click on Advanced Search.
And you can use this page for more detailed queries, also, Google search engine has its own built
in query language, and I'll give you a list of these search operators.
So you can also use these search operators to get detailed results.
So in order to benefit from Google more using these operators can come in quite handily.
So let's run some searches with some of these advanced operators.
OK?
So let's find New York Times subdomains.
Type site, Colen NY Times dot com dash site, Colen W w w dot NY Times dot com.
So the site command will bring the results that contain only and my time, Zackham.
And the dash before the second site will exclude the results that contain NY Times DOT.
OK, so look at the number of results.
Now, if you add.
And in Colin Log-in.
It will bring us the results that contain login pages.
But be careful, Google doesn't necessarily want us using the advanced search for our purposes.
Google will start blocking your connection if you connect from a single static IP.
OK, so it will ask for captcha challenges to prevent automated queries.
So I'm going to fill in this capture box.
It's always a favorite thing to do.
Now, look at the number of results, it decreases a lot.
Now add or in Earl Colon sign up to bring sign up pages.
So this time the number of results are increased.
So you can also look for a vulnerable version of any of the Web technologies.
So tight in Earl Colon, BHP, my admin slash index dot p and end title Colon P, my admin to DOT one
one.
And look at the results, it's going to bring up all of the pages that are version 2.0 one one of my
admin, so also we can perform the same search for NQ Light manager, just type in title, colon askew
like manager and Earl Colon slash askew light slash in text colon.
Welcome to.
And look at that, here are the rescue lite manager pages.
Now, there are a few pages listed.
But Google does not only index the HTTP based servers, it also indexes open FTP servers.
So if you type in title Colen index of an URL, Colan FTP open FTP servers will be listed.
I know you might say this is not enough where you can go with a prepared queries that are performed
by the hacking community.
Why didn't I say that before?
Because these queries are stored in the Google hacking database that you didn't know it existed.
Now you do.
So open this page.
GHB is also served by offensive security.
So here, every query is called Google Dork.
So you can apply any door to your target application and server, just click on any talk.
And from here, just click to see the Google search results and now you can analyze the results.
So imagine that a Drupal vulnerability is announced, you can create a Google query to identify the
servers or applications that have this vulnerability, or you can check Google hacking database to find
it and use it.
So now the world is up to your imagination and you.